AMENDMENTS TO THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently amended) A method for managing traffic in a public 
communications network comprising acts of: 

(a) providing, in a network device, a flow cache containing at least predefined 
characteristics associated with frequent flyer p ackets comprising packets received in 
bursts, and actions paired with selected ones of said predefined characteristics; 

(b) receiving at least one of the frequent flyer packets i n into the flow cache of 
said network device; 

(c) selecting, from said received packet, characteristics similar to the at least 
predefined characteristics; 

(d) correlating the characteristics selected from said received packet with the 
predefined characteristics; 

(e) using results from the correlating step to perform Layer 3 or higher 
classification of the received packet; 

(f) identifying data packets with most bundling when compared to other data 
packets , and avoiding the flow cache for those other data packets ; and 

(g) initializing an expiration timer that controls to control a frequency at which 
the cache is aged, wherein the expiration timer corresponds to an expected burst interval 
of the identified packets. 

2. (Original) The method of claim 1 wherein the process includes enforcing the 
paired action against the received packet if the characteristics of said received packet 
matches the at least predefined characteristics. 

3. (Original) The method of claim 1 or claim 2 wherein the at least predefined 
characteristics include Internet Protocol (IP) Destination Address (DA), IP Source 
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Address (SA), Transmission Control Protocol (TCP) Destination Port (DP) and TCP 
Source Port (SP). 

4. (Currently amended) The method of claim 1 wherein the correlating act 
includes comparin g the selected characteristics of the received packet with the predefined 
characteristics . 

5. (Currently amended) A method comprising acts of: 

providing in a memory a mapping of predefined characteristics associated with 
packets including packets received in bursts a nd actions to be performed; 
receiving packets to be classified; 

correlating selected characteristics of received packets with the predefined 
characteristics; 

performing stored actions on said received packets, if the selected characteristics 
match the predefined characteristics, wherein the performed stored actions include Layer 
3 or higher frame classification actions; 

identifying pack e ts with most bundling wh e n compar e d to oth e r data pack e t s 
avoiding stored actions on packets having characteristics that do not match the predefined 
characteristics ; and 

initializing an expiration timer that controls a frequency at which contents of the 
memory are altered, wherein the expiration timer corresponds to an expected burst 
interval of the identified packets. 

6. (Currently amended) The method of claim 5 wherein the correlating act 
includes comparin g the selected characteristics of the received packet with the predefined 
characteristics . 

7. (Original) The method of claim 5 wherein the predefined 
characteristics include Source Address (SA), Destination Address (DA), Source Port (SP) 
and Destination Port (DP). 
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8. (Original) The method of claim 5 wherein the received packets 

include data packets. 



9. (Previously presented) The method of claim 5 wherein the stored actions 
associated with predefined characteristics are updated only from a first packet of a group 
of packets. 

10. (Original) The method of claim 9 wherein the stored actions are being 
performed on all packets following the first packet of the group of packets. 

1 1 . (Currently amended) A system including 
a processor; 

j a flow cache operatively coupled to said processor, said cache storing a mapping 

between predefined characteristics of packets and actions wherein said processor 
executes a first program that causes said processor to correlate characteristics of selected 

| packets with the predefined characteristics and enforcing enforces on said selected 
packets actions associated with predefined characteristics if characteristics from the 
selected packets match the predefined characteristics; and 

a memory operatively coupled to said processor and storing therein[[:]]j 
a first data structure for a full packet search wherein said processor executes a 
second program that causes said processor to access the first data structure and imposing 
imposes on said selected packet an action stored in said first data structure if a mismatch 
occurs between the predefined characteristics and the characteristics from the selected 
packets; and 

a second data structure that includes an aging algorithm for aging the cache, the 
aging algorithm initializes an expiration timer, decrements the expiration timer by a check 
time interval that is less than a current value of the expiration timer, reviews a Layer 3 or 
Layer 4 database for a change to the Layer 3 or Layer 4 database, and purges the cache if a 
change has been made during the check time interval, wherein the expiration timer 
corresponds to an expected burst interval of data packets identified as frequent flyer 
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packets , and does not correspond to the time intervals between packets that are not 
identified as frequent flyers . 



12. (Original) The system of claim 1 1 wherein the predefined characteristics 
include Source Address (SA), Destination Address (DA), Source Port (SP) and 
Destination Port (DP). 

13. (Original) The system of claim 1 1 wherein the processor includes a network 
processor. 

14. (Cancelled). 

15. (Previously presented) The system of claim 1 1 wherein the selected packet 
includes received packets. 

1 6. (Previously presented) The system of claim 1 1 wherein the second program 
includes a full match algorithm. 

17. (Previously presented) The system of claim 1 1 wherein the second program 
includes a Longest Prefix Match algorithm. 

1 8. (Previously presented) The system of claim 1 1 wherein the second program 
includes a Software Managed Tree algorithm. 

19. (Previously presented) The system of claim 1 1 wherein the memory is 
internal to the processor. 

20. (Previously presented) The system of claim 1 1 wherein the memory is 
external to the processor. 
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21 . (Previously presented) The system of claim 1 1 wherein the data structure 
includes a Direct Table and Patricia Tree. 

22. (Currently amended) A system including 

a memory that stores a mapping between predefined characteristics of packets and 
actions to be performed for a subset of the set of all characteristic values, wherein the 
actions to be performed are Layer 3 or higher classification actions; and 

a controller that_performs the following actions: 

correlates characteristics in a received packet with the predefined 

characteristicSi-and p e rforming performs the actions on said received packet if 

the characteristics match the predefined characteristics and avoids performing 

actions on packets that do not match the predefined characteristics ; and 

uses an expiration timer to age the memory, wherein the expiration timer 

corresponds to an expected burst interval of packets identified as being frequent 

flyer packets. 

23. (Currently amended) A computer-readable medium comprising 
computer-executable instructions that, when executed by a processor, produce a method 
that comprises: 

correlating characteristics of a received packet with characteristics in a table, said 
table containing a subset of all possible characteristic values; 

enforcing an action stored in said table on the received packet if the 
characteristics of the received packet and the characteristics in the table match, wherein 
the action facilitates Layer 3 or higher packet classification , and avoiding said action if 
the characteristics do not match ; and 

updating contents of the table at times that correspond to an expected burst 
interval of data packets that are identified as being frequency flyer data packets. 

24. (Previously presented) The computer-readable medium of claim 23 further 
including instructions to generate the table containing the characteristics and associated 
actions. 
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25-30. (Cancelled) 



3 1 . (Currently amended) A method of classifying packets in a 

communications network comprising acts of: 

(a) receiving packets in a network device; 

(b) determining data packets present in received packets and identifying which 
packets are frequ e ncy frequent flyer packets by: [[;]] 

(ej) providing a cache in which predefined characteristics of packets and actions 
associated with selected ones of the predefined characteristics are stored; 

(ii) for each data packet so determined, correlating selected characteristics of said 
each data packet with the predefined characteristics in said cache; and 

(iii) for each data packet with selected characteristics matching one of the 
predefined characteristics imposing on said each data packet the action associated with 
said one of the predefined characteristics, wherein the packets include TCP/IP packets, 
and wherein the determining act further includes the acts of: 

(c) examining control bits in the TCP header; 

(i) if selected ones of said control bits are set to a first state, examining a 
length field in the IP header to determine its value; 

(ii) multiplying a value in the data offset field in the TCP header by 4; and 

(iii) subtracting the result of the multiplication from the value in the length 
field; and 

(d) updating contents of the cache at times that correspond to an expected burst 
interval of packets identified as frequency flyer packets. 

32-33. (Cancelled) 

34. (Previously presented) The method of claim 3 1 wherein the first state 
includes logical "0". 

35. (Previously presented) The method of claim 3 1 wherein the selected ones 
of said control bits include SYN, FIN and RST. 
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